Brotli2Shell hits Node.js and .NET: your Azure patch plan
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder that Node.js says permits remote code execution, and it reaches Node.js 22, 24 and 26, .NET 8, 9 and 10, and the PyPI Brotli package. Fixes landed on 21, 22 and 25 October 2026, Imperva has a working exploit on Node 24.22.0, Node 20 will never be patched, and this guide covers who patches what in Azure, which code paths decode untrusted Brotli, and a seven-step audit.
Azure's 30 September retirements: what stops working
More than ten Azure items retire on 30 September 2026, and the ones that fail silently are more dangerous than the ones that fail loudly: URL ping tests are deleted from your resources and the ContainerLog table stops receiving data, taking alert rules down with them. A triage guide with Resource Graph queries, Sweden Central cost math for standard web tests and Basic Logs, and a checklist for the Functions v3, Service Bus SBMP and 1 October AI service deadlines.